Is Save and Backup My Emails by cloudHQ safe?

Medium risk

Save and Backup My Emails by cloudHQ lists every signed-in Google account on Gmail load and sends the emails to cloudhq.net.

When Gmail loads, the extension checks Gmail sessions /u/0 through /u/20 to find each Google account signed in to the browser. It sends the list of account emails to cloudhq.net, at most once every two weeks per account, with no prompt shown first. The list includes secondary accounts that are not being backed up.

Strong link to a flagged operator: 4 of the 18 other listings from the same operator are rated high or critical for malicious behaviour. Flagged: HTML Editor (high), Meeting Scheduler for Gmail™ by cloudHQ (high), Screenshot (high).

cloudHQv1.2.0.15Chrome Web Store
49Risk
Who publishes it

cloudHQ LLC - 18 other listings from the same operator, 11 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
cloudHQ
Declared legal entity
cloudHQ LLC
Registered address
2247 29th Avenue, San Francisco, CA 94116, US
Registered contact
cloudHQ LLC
Website
support.cloudhq.net

Same store account

18 other listings published from this account, 339k+ users between them. 11 of them carry a finding.

Multi Email Forward by cloudHQ80k+MediumAuto BCC by cloudHQ60k+MediumHTML Editor50k+HighMeeting Scheduler for Gmail™ by cloudHQ30k+HighScreenshot20k+HighEmail Tracker by cloudHQ20k+Medium12 more listings in the relationship graph, on paid plans →

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

cloudHQ Gmail extension sends all signed-in Google account emails to cloudhq.net

Code analysis shows the extension reads the email of each Google account signed in to the browser on Gmail load and POSTs the full list to cloudhq.net, without a prompt.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open Gmail while signed in to one or more Google accounts.

The extension did this

The extension fetches each Gmail account slot and sends all discovered emails to cloudhq.net.

No dialog or setting precedes the request.

The code that does this

Account enumeration and upload

Readable version

Upload gate and POST

content.js
// Runs on Gmail load; skipped only if a marker younger than two weeks existsif (!marker || marker.timestamp < twoWeeksAgo) {  fn_get_switcher_account_emails(() => {    fn_ajax({ type: "POST", url: server_url + "main_pre_user/check",      data: { email, email_switcher_list: ALL_ENUMERATED_EMAILS,              email_or_login, chrome_extension_name, switch_login: "1" } });  });}

Account probing loop

content.js
// Probe Gmail account-switcher slots /u/0 .. /u/20 with the browser's Gmail cookiesfetch("https://mail.google.com/mail/u/" + index + "/?sw=2", {method:"GET", mode:"cors"})  .then(r => r.text())  .then(html => {    // pull every email-shaped string out of 'var GLOBALS=...;'    // push each new address into g_switcher_account_emails, then recurse to next index  });// max_tries = 20, so up to 21 account slots are read
POST body fields
  • Switcher email list

    Lists every Google account signed in to this browser, including unrelated ones.

  • Primary email
    alex.rivera@gmail.com

    The account currently open in Gmail.

  • Extension name
    cloudHQ Gmail extension (illustrative)

    Tells the server which cloudHQ product sent the request.

  • Switch login flag
    1

    Fixed value sent with each request.

When this fires

Every 14 days

The check repeats at most once every two weeks per account, gated by a timestamp in local storage.

Destination
    • www.cloudhq.net

    Vendor server receiving main_pre_user/check with the account list.

    • mail.google.com

    Source of the account data, read at /mail/u/N/?sw=2 for N=0..20.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 1.2.0.15. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on mail.google.com

    https://mail.google.com/

  • Read and change your data on www.cloudhq.net

    https://www.cloudhq.net/

  • Run its own code inside the pages you visit

    scripting

  • Store data in your browser

    storage

  • Keep running in the background while your browser is open

    background

Where it sends data

Destinations our analysis observed Save and Backup My Emails by cloudHQ contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.cloudhq.netwidely used

    Save and Backup My Emails by cloudHQ sends data to www.cloudhq.net. A widely used service: 79 other extensions we have analysed send data here.

Updated 15 October 2026fkbapenokeefpiaefagkinjhadmhjgmg